AZ-900 Describe Azure management and governance Practice Question
A company uses Azure Blueprints to define a repeatable set of Azure resources and policies for new subscriptions. They want to ensure that when a new subscription is created, a specific role assignment is automatically applied. What should they include in the blueprint definition?
⚠ Common exam trap
Many exam-takers confuse Azure Policy (which enforces rules) with RBAC role assignments (which grant permissions), leading them to select the Policy assignment option instead of the role assignment artifact.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A role assignment artifact
Azure Blueprints allow you to define artifacts that are applied to new subscriptions. A role assignment artifact is the correct choice because it directly assigns a specific Azure RBAC role to a user, group, or service principal at the subscription scope, ensuring the role is automatically applied when the blueprint is assigned to a new subscription.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A role assignment artifact
Why this is correct
A role assignment artifact in Azure Blueprints is explicitly designed to assign Azure RBAC roles to users, groups, or service principals at the target scope. When a blueprint is deployed, this artifact automatically creates the corresponding role assignments, ensuring consistent permissions across multiple environments. This directly satisfies the requirement to define repeatable access control, making it the correct choice.
- ✗
An Azure Policy assignment
Why it's wrong here
An Azure Policy assignment is used to enforce governance rules on resources, such as allowed locations or required tags, by evaluating compliance and optionally denying non-compliant actions. It does not assign RBAC roles to principals, as policy operates at the resource-level control plane, not on identity permissions. Thus, a policy artifact is incorrect for establishing access control in this blueprint.
When this WOULD be correct
If the question asked about automatically enforcing a policy (e.g., requiring a specific tag on all resources) when a new subscription is created, then an Azure Policy assignment would be the correct artifact to include in the blueprint.
- ✗
An Azure Resource Manager template
Why it's wrong here
An Azure Resource Manager (ARM) template is a generic deployment file that can define resources, including the Microsoft.Authorization/roleAssignments resource type, but it is not the dedicated blueprint artifact for role assignment. Using an ARM template for RBAC requires nested deployments and additional boilerplate, whereas the role assignment artifact is a first-class, simplified Blueprint component. Since the question specifically asks what artifact assigns roles, the ARM template is not the best answer.
When this WOULD be correct
An ARM template would be correct in a blueprint if the goal is to deploy a consistent set of Azure resources (e.g., VMs, storage accounts) across new subscriptions, rather than assigning a role.
- ✗
A resource group
Why it's wrong here
A resource group is a logical container that holds related Azure resources, not an artifact that grants security permissions. While a blueprint can include a resource group artifact to organize resources, that artifact merely creates the group itself and does not assign any RBAC roles. Therefore, resource groups cannot provide the role-granting capability the scenario requires.
When this WOULD be correct
When the question asks for the component that organizes and holds the deployed resources within a subscription, such as 'What should you create to group all resources for a project in a blueprint?'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓A role assignment artifactCorrect answer▾
Why this is correct
A role assignment artifact in Azure Blueprints is explicitly designed to assign Azure RBAC roles to users, groups, or service principals at the target scope. When a blueprint is deployed, this artifact automatically creates the corresponding role assignments, ensuring consistent permissions across multiple environments. This directly satisfies the requirement to define repeatable access control, making it the correct choice.
✗An Azure Policy assignmentWrong answer — click to see why▾
Why this is wrong here
Azure Policy assignments enforce compliance rules but do not directly assign roles to users or groups. Role assignments require a role assignment artifact in Azure Blueprints.
★ When this WOULD be the correct answer
If the question asked about automatically enforcing a policy (e.g., requiring a specific tag on all resources) when a new subscription is created, then an Azure Policy assignment would be the correct artifact to include in the blueprint.
Why candidates choose this
Candidates may confuse policy assignments with role assignments because both are used for governance and can be included in blueprints, but they serve different purposes.
✗An Azure Resource Manager templateWrong answer — click to see why▾
Why this is wrong here
Azure Blueprints use role assignment artifacts to assign roles, not ARM templates. ARM templates define infrastructure resources, not role assignments directly.
★ When this WOULD be the correct answer
An ARM template would be correct in a blueprint if the goal is to deploy a consistent set of Azure resources (e.g., VMs, storage accounts) across new subscriptions, rather than assigning a role.
Why candidates choose this
Candidates may think ARM templates are the only way to automate deployments in Azure, overlooking that Blueprints have specific artifact types for role assignments.
✗A resource groupWrong answer — click to see why▾
Why this is wrong here
A resource group is a container for resources, not a blueprint artifact that applies role assignments. Blueprints use role assignment artifacts to assign roles at subscription scope.
★ When this WOULD be the correct answer
When the question asks for the component that organizes and holds the deployed resources within a subscription, such as 'What should you create to group all resources for a project in a blueprint?'
Why candidates choose this
Candidates may confuse resource groups as a way to apply permissions, thinking that placing resources in a group automatically inherits role assignments, but role assignments must be explicitly defined via artifacts.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
Key term
Role
A role is a named set of permissions that can be assigned to users or groups to control access to resources in an IT environment.
About these practice questions
One of 981 original AZ-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.